Strangers can always create an account using SSO authentication (OpenID)

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 7.0 DE (7.0.10), 7.1 DXP (7.1.10)
• Fix Version/s: 7.0.X EE, 7.1.x EE
• Component/s: Application Security > OpenID
• Labels:
  • liferay-fixpack-de-85-7010
  • liferay-fixpack-dxp-13-7110
  • lsv
  • lsv-646
  • sev-3
• Business Value: 3
• CVSS Base Score: 6.5
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

In Liferay DXP 7.1 and DXP 7.0, SSO authentication does not respect the setting, "Allow strangers to create accounts?" If SSO authentication is enabled, users who authenticate using Facebook, Google, OpenID, OpenID Connect or OpenSSO can create an account even if strangers are not allowed to create accounts.

Note: OpenID SSO is not bundled with DXP 7.2.